How to graph by other fields after a top 10?

[lavaca]

The fields I am interested in are: action (100+ values), customer (6 values), timeTaken (~continuous)

I would like to plot a bunch of graphs, but only from entries of the 10 most common actions across all customers.

For example, a column chart with each of these 10 actions along the x-axis, the 95th percentile of timeTaken on y, with stacking columns for each customer. So far I have tried:

top 10 action | chart perc95(timeTaken) by action, customer

This returns no results found, so I tried to create my own top 10 using sort and head:

stats count by action | sort -count | head 10 | chart perc96(timeTaken) by action,customer

I get what I expect after head 10, but then cannot plot the graph I need after that - it returns no results found.

Help would be very much appreciated! Thank you.

[somesoni2 · Accepted solution]

Both top and stats in your command are removing the field timeTaken, hence when you try to chart using unavailable field timeTaken, it returns no rows.
Try something like this (the subsearch gets the top 10 action for each customer, add that as filter, so that your chart will show data for those only)

your base search  [ your base search | stats count by action, customer | sort customer -count | streamstats  count as sno by customer | where sno<=10 | table customer action | format]  | chart perc96(timeTaken) by action,customer

[lavaca]

Thank you, a subsearch did the trick!

[bmacias84]

You can use the map command.

... | top 10 customer | map search="search ... customer=$customer$ | chart perc95(timeTaken) by action, customer "